Malware Prevention Guide

Website malware is much easier to prevent than to clean up. Regular updates, secure logins, reliable backups, and ongoing monitoring can significantly reduce the risk of an infection and make recovery easier if something does go wrong.

Keep WordPress, Plugins, and Themes Updated

Outdated software can contain security vulnerabilities that attackers may exploit.

• Keep WordPress core up to date.
• Update plugins and themes regularly.
• Remove plugins and themes you no longer use.
• Avoid abandoned plugins that are no longer maintained by their developers.
• Never install nulled or pirated themes and plugins.

Before making major updates, make sure a recent backup is available and confirm compatibility when necessary.

Protect Website Logins

Administrator access should be limited and protected.

• Use strong, unique passwords for WordPress, hosting, and other website-related accounts.
• Do not reuse passwords across multiple services.
• Enable two-factor authentication (2FA/MFA) when available.
• Give administrator access only to people who need it.
• Remove old or unused user accounts.
• Avoid sharing passwords through unsecured messages.

Whenever possible, each person who works on the website should have their own account rather than sharing one administrator login.

Maintain Reliable Backups

Backups are an important part of both prevention and recovery.

• Back up the website regularly.
• Keep backups in a separate, secure location when possible.
• Know how frequently backups are created and how long they are retained.
• Make sure both website files and the database are included.
• Periodically confirm that backups can actually be restored.

A backup should not be assumed to be clean after an infection. If malware is discovered, the backup should be checked before restoration.

Limit Website Access and Use Trusted Software

Every additional login, plugin, or third-party connection can create another potential point of access.

• Install plugins and themes only from reputable sources.
• Remove software and integrations that are no longer needed.
• Limit administrator privileges when a lower access level will work.
• Remove access for former employees, contractors, or developers who no longer need it.
• Keep hosting, database, FTP/SFTP, and other technical credentials secure.

What to Do If You Suspect Malware

If you notice suspicious activity:

1. Contact your website developer, hosting provider, or BrushPic.
2. From a trusted device, change potentially compromised passwords.
3. Confirm whether a clean backup is available.
4. Avoid deleting unfamiliar files unless you know what they are.
5. Do not install random security tools in an attempt to fix the problem.
6. If visitors may be at risk, temporarily restrict access to the website while the issue is investigated.

If customer or sensitive information may have been exposed, seek appropriate guidance about any required notifications.

You can check What to Do If Your Website Gets Hacked or Has Malware here.

How a Malware Infection Is Usually Addressed

Depending on the infection, a developer or security specialist may need to:

• Scan website files and the database.
• Identify and remove malicious code.
• Remove unauthorized users or access.
• Restore clean files or a verified clean backup.
• Update vulnerable WordPress components.
• Reset compromised credentials.
• Test the website after cleanup.
• Monitor for reinfection.

If Google has flagged the website as unsafe, an additional review may be required after the malware has been removed.